Skip to main content


Showing posts from January, 2018

Beyond Net User - Part 1: Limitations of the "Net" commands

I've had a number of cases where the Windows "net user", "net group", and "net localgroup" have failed me. I've had SQLMap fail to give the last line of "net user" output, I've had "net group /domain" not give me the full names (I still don't get how that failed!). On top of that, the commands don't support wildcards. Also, the output of those commands is a pain to parse due to the columns. I'd much prefer to use the AD PowerShell cmdlets, but those aren't always available. I set to find other ways to get the same data. First, let's look at the limitations of the "net" commands.
Net command limitations Hiding Groups in Groups Often when pen testing and red teaming, we would like to figure out information about the domain, most notably the members of the Domain Admins group. Output of the net group "domain admins" command as shown below.

It shows three members: Administrator, sqlagent,…

Better FDE Passphrase with macOS FileVault

I use full disk encryption (FDE) on all my laptops and portable media. I like to have a very strong passphrase for these, one that is even stronger than that for my user accounts. Let's be realistic, very very few people are going to use a 60 character passphrase for their daily account, but I wouldn't mind using that to unlock my laptop since I only have to enter it so rarely (and I go through customs a lot). With the Mac, there isn't a nice built in way to have a long unlock passphrase for FileVault and a more reasonable one for day to day use of the laptop. However, we can use the features we have in the OS to make this happen.
Summary:User 1 ("unlock") used solely to unlock the disk. This user has a long, secure passphrase. You won't use the device as this user. This user does not need to be an administrator.All other users, the day-to-day user(s) has a more manageable passphrase. At least one of these users is an administrator. Summary of steps:Create an…